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A quantum cipher supported by a secret key so called keyed communication in quantum noise 
(KCQ) is very attractive in implementing high speed key generation and secure data transmission. 
However, Yuen-2000 as a basic model of KCQ has a difficulty to ensure the quantitative security 
evaluation because all physical parameter for the cipher system is finite. Recently, an outline of 
a generalized scheme so called coherent pulse position modulation(CPPM) to show the rigorous 
security analysis is given, where the parameters are allowed to be asymptotical. This may open 
a new way for the quantum key distribution with coherent states of considerable energy and high 
speed. 

In this paper, we clarify a generation method of CPPM quantum signal by using a theory of 
unitary operator and symplectic transformation, and show an asymptotic property of security and 
its numerical examples. 

PACS numbers: 03.67.Dd, 42.50.Lc 



I. INTRODUCTION 



An application of quantum phenomena to securing op- 
tical network has received much attention. In this case, 
instead of mathematical encryption, a guarantee of secu- 
rity by a physical principle is expected. So far the quan- 
tum key distribution(QKD) based on very weak optical 
signals has been developed and demonstrated in many 
institutions. However, these have inherent difficulty such 
as quantum implementations and very low bit rates com- 
pared to current data transmission rates. 

In order to cope with such a drawback, in 2000, a new 
quantum cipher was proposed [1]. It is a kind of stream 
cipher with randomization by quantum noise generated 
in measurement of coherent state from the conventional 
laser diode. The scheme is called Yuen-2000 protocol(Y- 
00) or arj scheme[2,3] which consists of large number of 
basis to transmit the information bit and pseudo random 
number generator(PRNG) for the selection of the basis. 
A coherent state as the ciphertext which is transmitted 
from the optical transmitter (Alice) is determined by the 
input data and the running key K from the output se- 
quence of PRNG with a secret key K s . The legitimate 
receiver(Bob) has the same PRNG, so he can receive the 
correct ciphertext under the small error, and simulta- 
neously demodulate the information bit. The attacker 
(Eve), who does not know the key, has to try to discrim- 
inate all possible coherent state signals. Since the signal 
distance among coherent state signals are designed as 
very small, Eve's receiver suffers serious error to get the 
ciphertext. Such a difference of the accuracy of the ci- 
phertext for Bob and Eve brings preferable security which 
cannot be obtained in any conventional cipher. Unfor- 



tunately, it is very difficult to clarify the quantitative 
security evaluation for this type of cipher, because all 
physical parameter for the cipher system is finite. So far, 
complexity theory approach [4] and information theoretic 
approach [5] have been tried, but still there is no rigorous 
theoretical treatment. 

Recently, Yuen has pointed out that it is possible to 
show the rigorous security analysis when the parameters 
are allowed to be asymptotical, and showed a sketch of 
the properties using a model of coherent pulse position 
modulation (CPPM) [6]. This may open a new way for 
the quantum key distribution with coherent states of con- 
siderable energy and high speed. 

In this paper, we clarify a generation method of CPPM 
quantum signal by using a theory of unitary operator 
and symplectic transformation, and show a security prop- 
erty and its numerical examples. In the section II, the 
back ground for the information theoretic security and 
the Shannon limit are explained. In the section III and 
IV, we describe a theory of CPPM. In the section V and 
VI, we discuss on the security and implementation prob- 
lem. 



II. BACK GROUND OF INFORMATION 
THEORETIC SECURITY 

In the conventional cipher, the ciphertext Y is deter- 
mined by the information bit X and running key K. This 
is called non random cipher. However, one can introduce 
more general cipher system so called random cipher by 
noise such that the ciphertext is defined as follows: 



Y i = f(X i) K i ,r i ) 



(1) 
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where rj is noise. Such a random cipher by noise may 
provide a new property in the security. In Shannon 
theory for the symmetric key cipher, we have the 
following theorem. 



Theorem l(Shannon, 1949 [7]) 

The information theoretic security against ciphertext 

only attack on data has the limit 



H(X\Y) < H(K S ). 



(2) 



This is called Shannon limit for the symmetric key ci- 
pher. To be beyond the Shannon limit is essential for 
fresh key generation by communication or information 
theoretic security against known plaintext attack in the 
symmetric key cipher. In the context of random cipher, 
one can exceed this limit. It is known that the necessary 
condition for exceeding the limit is Y E ^ Y B [6,8,9]. 
That is, the ciphertexts for Bob and Eve are different. 
Still the necessary and sufficient condition is not clear, 
but if the following relation holds, one can say that the 
cipher exceeds the Shannon limit 



H(X\Y E ,K S ) >H(X\Y B ,K S 



0. 



(3) 



This means that Eve cannot pin down the information 
bit even if she gets a secret key after her measurement 
of the ciphertext while Bob can do it. In the following 
sections, we will clarify that CPPM has indeed such a 
property. 



III. COHERENT PULSE POSITION 
MODULATION CRYPTOSYSTEM 

The coherent pulse position modulation (CPPM) cryp- 
tosystem has been proposed as a quantum cipher permit- 
ting asymptotical system parameters [1,6]. 

Alice encodes her classical messages by the block en- 
coding where n-bit block j (j = 1,....,N = 2") corre- 
sponds to the pulse position modulation (PPM) quantum 
signals with N slots, 



|$,) = |0>i 



\ao)j • • • |0>jv- 



(4) 



In addition, Alice apply the unitary operator Uki to 
PPM quantum signals |$j), where the unitary operator 
Uxi is randomly chosen via running key Ki generated by 
using PRNG on a secret key K s . Thus, Alice gets CPPM 
quantum signal states, 



\* j (K i )) = U Ki \* i 



*ij(Ki))i • • • \a N j{Ki)) N , 



(5) 

which are sent to Bob. Let us assume an ideal channel. 
Since the secret key K s , PRNG and the map Ki — *• Uki 
are shared by Alice and Bob, Bob can apply the uni- 
tary operator U K , to the received CPPM quantum sig- 
nal \fyj{Ki)) and obtain the PPM quantum signal |$j). 
Bob decodes the message by the direct detection for |$j), 
which is known to be a suboptimal detection for PPM 
signals [10]. Then Bob's block error rate is given by 



P. 



dir 



(i 



N' 



-|"ol 



< e 



-hoi 2 



(6) 



Here e~' Q °' w holds for enough large signal energy 
S = |ct | 2 - In contrast, Eve does not know the secret key 
K s and hence she must detect CPPM quantum signals 
directly. This makes Eve's error probaility worse than 
Bob's one. 



IV. CONSTRUCTION OF CPPM 

In this section, we discuss a method for the construc- 
tion of CPPM quantum signals from PPM ones by the 
unitary operator associated with a symplectic transfor- 
mation. 



A. Quantum Gaussian States 

The classical probability distribution 7r is characterized 
by the characteristic function <fi(z) — f exp[ix T z]ir(dx). 
The characteristic function of Gaussian distribution with 
the mean m and the correlation matrix B is given as 
(fi(z) = exp[im T z — ^z T Bz}. We extend this argu- 
ment to define the quantum Gaussian state [11]. We 
consider self adjoint operators on a Hilbert space "H, 
qi,Pi,q2,P2,---,qN,PN satisfying Heisenberg CCR: 



[qj,Pk]=iSjkhI, [qj,qk]=0, \pj,Pk]=0, (7) 

where 8j t k = 1 for j = k and 6j k = for j =/= k. Let us 
introduce unitary operators 



V(z) =cxp(ii? T z) 
for a real column 2r-vector z and 

R= [q 1 ,p 1 ;...;q N ,p N ] T ' . 
The operators V(z) satisfy the Weyl-Segal CCR 



(8) 



V(z)V(z') = cxp 



£A(s,s') 



V(z + z'), 



where 

A(z,z') = -z T A N z' 
is the canonical symplectic form with 

N 



A.=e 



*;=! 



ft 
-ft 



(9) 



(10) 



(11) 



The Weyl-Segal CCR is the rigorous counterpart of 
the Heisenberg CCR, involving only bounded operators. 
Now we can define the quantum characteristic function 



4>{z) = TipViz). 
The transformation C satisfying 

A(£ T z,£ T z') = A(z,z') 



(12) 



(13) 



is called a symplectic transformation. We denote the to- 
tality of symplectic transformations by Sp(N, M) . Eq. 
(13) can be rewritten as 



CA N C T = A 



N- 



(14) 



The symplectic transformation preserves Weyl-Seagl 
CCR (9) and hence it follows from Stone-von Neumann 
theorem that there exists the unitary operator U satisfy- 
fog [11] 



V{C T z) = U*V(z)U. 



(15) 



We call such derived operator U the unitary operator 
associated with symplectic transformation C. 

The density operator p is called Gaussian if its quan- 
tum characteristic function has the form 



(z) = TrpV(z) = exp 



■ T 
im z 



1 



-z r Az 



(16) 



In an iV-mode Gaussian state, to is a 2iV-dimensional 
mean vector and A is a 2N x 2iV-corralation matrix. The 
mean m can be arbitrary vector; the necessary and suffi- 
cient condition on the correlation matrix A is given by 



A^AA^v 1 



\a~ x <q. 



(17) 



The coherent state \a) (a = x + iy) is the quantum 
Gaussian state with the mean 



(18) 



m = \/2h(x, y) 
and the correlation matrix 



h 

A\ = - 
2 



1 
1 



(19) 



and the iV-ary coherent state \a{) 



\a N ) {a 3 



iyj) is the quantum Gaussian state with the mean 



/ 2^(xi,g/i, ,x N ,y N ) T 

and the correlation matrix 

N 



A 



N 





fe=l 



1 
1 



(20) 



(21) 



B. Generation of CPPM quantum signals by 
symplectic transformation 

We study a way to generate CPPM quantum signals 
by the unitary operator U associated with a symplectic 
transformation. Any unitary operator composed of beam 
splitters and phase shifts can be described by a symplec- 
tic transformation. First, let us consider the state U\<p) 
for a general 7V-ary coherent state \<j>) = |ai)0- • -0 |ajv)- 



By using Eq. (15), the quantum characteristic function 
of the state U\4>) is given as 



<£(«) = TH7|#)<0H7ty(«) = Ti\<j)){<f)\V{C T z) 
1 



exp 



(Cm) 1 z - ^z T CA N C T z 



(22) 



where to and An is the mean vector and the correlation 
matrix given by Eqs. (20) and (21) respectively. Eq. (22) 
shows that the state U\cf>) is the quantum Gaussian state 
with the mean Cm and the correlation matrix CA^C T . 
Our interest is devoted to the case where the state U\<j>) 
is an 7V-ary coherent state. Then the symplectic trans- 
formation C should satisfy the condition CAjyC T = A^ 1 
that is, 

C e 0{2N) := {C e M(2N, R)\CC T = I 2N } (23) 

where I 2 n is the 2N x 2N identity matrix and M(2N, R) 
is the set of 2N x 2N real matrices. Denoting the totality 
of N x iV-unitary matrices by U(N), we have the relation 



Sp(N,R)nO(2N) = U(N). 

Here the matrix 

r 11 R(9 11 ) 



(24) 



ri N R(6i N ) 



C = 



k T"NiR(0ni) ■ ■ ■ T'AW-R^Aw) 

e Sp(N,R)nO(2N), 

with real numbers r^ and rotation matrices R(6jk) 
responds to the matrix 



C c = 



rue""' 

K r N1 e* 9 ' 
G U(N). 



n N e' 



r NN e 1 ' 



(25) 



cor- 



(26) 



We can find that the unitary operator associated with 
Cc € U(N) transforms the state \<p) = |«i)0- • -®|ajv) to 
the state \<j>') = \a[)®- ■ -®\a N ), where a — (ai, ..., ax) T 
and a 1 — (a' l7 ...,a' N ) T are related in the equation 



= C 



cot. 



(27) 



In particular, from the PPM quantum signals |$j) = 
|0)i ® ■ ■ ■ \a )j • • • |0)jv, 3 = 1, 2, .., N, the CPPM 
ones are generated as 



l*,> - 



,/f 



>>k=i\ a orkje~ K: >)k,j = 1,2,.. 
In other words, jV-ary coherent states 

1,..JV, 



,N. 



"ik=Mkj)k,i 



(28) 



(29) 



are the CPPM quantum signals generated by applying 
the unitary operator associated with Cc € U(N) to the 
PPM quantum signals |$j) if and only if the matrix with 
(k, j)-elements a/t.j/ao is unitary. 



SECURITY ANALYSIS OF CPPM 
CRYPTOSYSTEM 



Error probability for CPPM quantum signal 
with key after measurement 



A. Heterodyne attack 

We give a foundation for discussing security of CPPM 
cryptosystem. Without knowing the secret key K s Eve 
cannot apply the appropriate unitary operator to CPPM 
quantum signals, and hence she has to receive directly 
CPPM quantum signals. Since the quantum optimum 
receiver is unknown for such signals, we apply the het- 
erodyne receiver, which is suboptimum and appropriate 
to discuss the performance of error. This scheme is called 
heterodyne attack. 

Our main target in this subsection is to study the het- 
erodyne attack on U\<p), where U is the the unitary op- 
erator associated with Cc S U(N), and \<f>) is a general 
iV-ary coherent state |ai) <8> • • • |ajv)- 

Heterodyne detection is characterized by a family of 
operators with a parameter j3 <G C, 



*G0) = -|WI 

7T 



(30) 



The outcomes j3 of the heterodyne detection for a coher- 
ent state | a) appears with the probability density func- 
tion 



1 



Tr\a)(a\X(J3) = -\{c 



2 _ :L-|a-/3| : 



(31) 



which represents the normal distribution with the corre- 
lation matrix (1/2) 1%. 

The outcomes f3 — (j3i, ...,/3jv) t of the indivisual het- 
erodyne detection for U\4>) obeys the probability density 
function, 



Pu\4,)0) = Tr(7|0)(0|t/t ®f =1 Xifit) 



(32) 



Tr|</>)<^| 



ui\4>)W\u 



r N 



with \ijj) = \Pi) ••• |/3jv). Here, putting /?' = 
(/3[, ...,(3' N ) T = Cq/3 and taking account of Eq (27), we 
get 



W\1>)(il>\U 



x = ®£i*(#). 



(33) 



Note that * represents the conjugate transpose and C* c 
corresponds to the unitary operator W . Substituting this 
equation to Eq. (32), we obtain 



p uw w) = p l4>) (n 



(34) 



where Pi^\ is the probability density function with which 
the outcomes of heterodyne detection for the state \<j>) 
appears. Eq. (34) shows that the vectors /?' given by 
applying the unitary matrix C* c to the outcomes f3 obeys 
the probability density function P\c/>)- 



It is difhcult to evaluate the error performance for 
CPPM quantum signals by heterodyne attack, because 
the randomness of PRNG has to be taken into account. 
Yuen showed the lower bound of the error performance by 
using heterodyne detection for the original PPM quan- 
tum signals [6]. But it may be not tight one. Here we 
try another approach. We allow Eve to get the secret 
key K s after her measurement by heterodyne for CPPM 
quantum signals and hence to know the unitary operator 
Uxi and the corresponding unitary matrix Cc.Ki ■ Then, 
from the discussions in the subsection V A, Eve can apply 
the unitary matrix C* c K , to obtain the vector f3' , which 
obeys to the probability density function Pi<j> .\ . This fact 
enables us to apply the decoding process for PPM signals. 
That is, Eve may use maximum-likelihood decoding for 
f3', whose rule is to pick the j for which /?'• is largest, and 
her error probability is given as follows [12]: 






(y - s/2Sf 



where S = \ao\ , and 



Qn{v) 

*(y) 



i - My)} 

1 rv 



N-l 



V2^ J- 



exp(— v 2 /2)dv. 



QN{y)dy, 
(35) 

(36) 



We will compute the lower bounds of Eve's error proba- 
bility P^ et (key) to evaluate its convergence speed. The 
error probability P^ et (key) is lower bounded as [12]: 



Pr(key) > 



1 



cxp 



(y - V25) 



2?r J- c 

>Q N (z)^(z-V2S), 



QN{y)dy 

(37) 



where the parameter z can take any real number value. 
Putting z = \fjn and n = log 2 N in (37), we obtain 



Pe e \key) > 



DC'. 

(38) 
Let us consider the case of S = 20. Then Bob's er- 
ror probability P^ vr is less than 10" 869 , while P^ et (key) 
converges to 1. Figure 1 shows convergence behavior 
of lower bound for P^ et (key). In this figure, the lower 
bounds (37) for / = 0.9, 1.1, 1.2, are plotted with respect 
to n = logM . Since the parameter / in the lower bound 
(37) can take arbitrary real number, values of error prob- 
ability P^ et (key) exist the region above the graphs in 
Figure 1. Note that the above values of / are chosen 
as they give better lower bounds for P£ et {key). From 
Figure 1, it is found that the convergence speed of lower 
bound for P^ et (key) is very slow; n > 50 ( N > 2 50 ) is 
needed to achieve the error probability 0.9. 



Thus, in the CPPM scheme, Eve cannot pin down the 
information bit even if she gets the true secret key K s 
and PRNG after her measurement, and consequently it 
has been proved that CPPM satisfies Eq(3). 
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Thus, the bandwidth exponentially increases with re- 
spect to n. Since one needs the large n to ensure the 
security, one needs a huge bandwidth. 

On the other hand, we need to realize the unitary 
transformation to generate CPPM quantum signals from 
PPM ones. Such transformations may be implemented 
by combination of beam splitters and phase shifts [6], 
but to generate the CPPM quantum signals with uni- 
form distance for all signal, we need also large number 
of elements. Thus we need more detailed consideration 
for the practical use. In future work, we will specify the 
realization method. 



VII. CONCLUSION 



FIG. 1: Lower bounds for Eve's decoding error probability in 
the case where she gets the secret key K s after her measure- 
ment for CPPM quantum signals 



VI. SUBJECTS ON SYSTEM 
IMPLEMENTATION 

According to the above analysis, one needs large num- 
ber of n when the signal energy is large. Here we give a 
requirement of channel bandwidth for the secure commu- 
nication by CPPM. Let us assume that the signal band 
width is W s when there is no coding. In our scheme, 
first one has to transform the n input information bit se- 
quence to PPM signal with 2 ra slots. Second, such PPM 
signals are converted into CPPM with the same number 
of slots. If one wants to transmit such CPPM signal with 
no delay, the required bandwidth is 



A crucial element of the coherent pulse position mod- 
ulation cryptosystem is a generation of CPPM quantum 
signals from PPM ones by a unitary operator. In this pa- 
per, we have given a proper theory for a unitary operator 
and a symplectic transformation basing on the quantum 
characteristic function. Furthermore, by using the above 
results, we have shown the lower bound of error proba- 
bility in the case where Eve gets the secret key after her 
measurement. This result clearly guarantees the fresh 
key generation supported by the secret key encryption 
system. 



on 

W C PPM = — W s 
n 



(39) 
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